Skills marketplace agents advertise available micro payment gateway

[ekwe7]

closes #305

Summary
This PR introduces the backend API surface for the Skills Marketplace, allowing agents to register, publish, discover, and deactivate skills that can be invoked through x402-enabled payment endpoints.

The marketplace provides a searchable catalog of agent capabilities while enforcing pricing, ownership, and platform limits to ensure a consistent and secure experience.

Context

PR #304 introduces a Skills Marketplace where agents can expose capabilities and monetize them through the x402 HTTP payment protocol.

To support marketplace functionality, the backend requires:

Skill registration
Skill discovery and filtering
Skill deactivation
Ownership enforcement
Marketplace validation rules

This PR implements the storage model and API endpoints necessary to support those workflows.

Skill Model

Implemented in:

lib/marketplace/skill-store.ts
Skill Type
type Skill = {
id: string
agentId: string
name: string
description: string
priceXLM: number
callUrl: string
active: boolean
createdAt: number
}
Fields
Field Description
id Unique skill identifier
agentId Owning agent identifier
name Marketplace skill name
description Human-readable description
priceXLM Invocation price in XLM
callUrl HTTPS x402-enabled invocation endpoint
active Marketplace visibility status
createdAt Creation timestamp
API Endpoints
Register Skill
POST /api/marketplace/skills

Creates a new marketplace skill.

Authentication

Required.

Only authenticated agents may register skills.

Example Request
{
"name": "pdf-to-text",
"description": "Convert PDF documents into text",
"priceXLM": 0.5,
"callUrl": "https://agent.example.com/x402/pdf-to-text"
}
Response
{
"id": "skill_123",
"agentId": "agent_456",
"name": "pdf-to-text",
"description": "Convert PDF documents into text",
"priceXLM": 0.5,
"callUrl": "https://agent.example.com/x402/pdf-to-text",
"active": true,
"createdAt": 1710000000
}
List Skills
GET /api/marketplace/skills

Returns all active marketplace skills.

Supported Filters
Query Parameter Description
name Filter by skill name
maxPriceXLM Maximum allowed skill price
agentId Filter by skill owner
Examples

List all active skills:

GET /api/marketplace/skills

Filter by name:

GET /api/marketplace/skills?name=pdf-to-text

Filter by maximum price:

GET /api/marketplace/skills?maxPriceXLM=1

Filter by agent:

GET /api/marketplace/skills?agentId=agent_123

Combined filters:

GET /api/marketplace/skills?name=pdf&maxPriceXLM=1
Deactivate Skill
DELETE /api/marketplace/skills/[skillId]

Deactivates an existing skill.

Authorization

Only the owning agent may deactivate a skill.

Behavior
Sets active = false
Removes skill from marketplace listings
Preserves historical data
Response
{
"success": true
}
Validation Rules
Price Validation

Skills must satisfy:

0 < priceXLM ≤ 100

Invalid values return:

400 Bad Request

Examples:

0
-1
101
HTTPS Enforcement

All invocation endpoints must use HTTPS.

Valid:

https://agent.example.com/skill

Invalid:

http://agent.example.com/skill

Invalid URLs return:

400 Bad Request
Agent Skill Limit

Maximum skills per agent:

20

When exceeded:

429 Too Many Requests

This prevents marketplace abuse and excessive catalog growth.

Security
Ownership Enforcement

Only the owning agent can:

Modify their skills
Deactivate their skills

Unauthorized requests are rejected.

Visibility Rules

Only active skills appear in marketplace search results.

Inactive skills remain stored but hidden.

Testing

Added unit tests covering:

Skill Registration
Successful skill creation
Authentication requirements
Validation failures
Marketplace Listing
Active skills returned
Inactive skills excluded
Name filtering
Agent filtering
Price filtering
Deactivation
Owner can deactivate
Non-owner cannot deactivate
Deactivated skills disappear from listings
Limits
Up to 20 skills allowed
21st registration rejected
Correct HTTP 429 response returned
Acceptance Criteria

POST creates marketplace skills

GET returns active skills

Name filter supported

maxPriceXLM filter supported

agentId filter supported

Skills over maxPriceXLM are excluded

HTTPS validation enforced

Price validation enforced

Maximum 20 skills per agent enforced

21st skill returns 429

DELETE deactivates skills

Deactivated skills disappear from listings

Ownership checks enforced

Unit tests cover listing, filtering, deactivation, and limits

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[leocagli]

Hi @ekwe7 — this is blocked by the required SonarCloud Code Analysis gate failing. See the dashboard, fix the flagged items and push. 🙏

[leocagli]

Thanks @ekwe7 — the required SonarCloud Code Analysis quality gate is failing on this PR (see the SonarCloud dashboard linked in the checks). Typically it's new-code duplication, insufficient coverage on new code, or code smells/security hotspots. Please open the SonarCloud report for this PR, resolve the flagged issues (add tests for new code, dedupe, address smells), and push — once the gate passes (and the branch is rebased on current main) it can merge.